DO NOT MERGE: Experimental crypton+ram branch

bench/tx-generator/src/Cardano/Benchmarking/GeneratorTx/SubmissionClient.hs

@@ -24,7 +24,7 @@ module Cardano.Benchmarking.GeneratorTx.SubmissionClient
   , txSubmissionClient
   ) where
 
-import           Cardano.Api hiding (Active)
+import           Cardano.Api hiding (Active, CardanoBlock)
 
 import           Cardano.Benchmarking.LogTypes
 import           Cardano.Benchmarking.Types
@@ -36,7 +36,6 @@ import qualified Ouroboros.Consensus.Cardano.Block as Block
                    (TxId (GenTxIdAllegra, GenTxIdAlonzo, GenTxIdBabbage, GenTxIdConway, GenTxIdMary, GenTxIdShelley))
 import           Ouroboros.Consensus.Ledger.SupportsMempool (GenTxId)
 import qualified Ouroboros.Consensus.Ledger.SupportsMempool as Mempool
-import           Ouroboros.Consensus.Shelley.Eras (StandardCrypto)
 import qualified Ouroboros.Consensus.Shelley.Ledger.Mempool as Mempool (TxId (ShelleyTxId))
 import           Ouroboros.Network.Protocol.TxSubmission2.Client (ClientStIdle (..),
                    ClientStTxIds (..), ClientStTxs (..), TxSubmissionClient (..))

bench/tx-generator/src/Cardano/Benchmarking/LogTypes.hs

@@ -22,7 +22,7 @@ module Cardano.Benchmarking.LogTypes
   , TraceBenchTxSubmit (..)
   ) where
 
-import           Cardano.Api
+import           Cardano.Api hiding (CardanoBlock)
 
 import           Cardano.Benchmarking.OuroborosImports
 import           Cardano.Benchmarking.Types

cabal.project

@@ -13,8 +13,9 @@ repository cardano-haskell-packages
 -- See CONTRIBUTING for information about these, including some Nix commands
 -- you need to run if you change them
 index-state:
-  , hackage.haskell.org 2026-08-09T23:27:58Z
-  , cardano-haskell-packages 2026-08-07T15:03:01Z
+  , hackage.haskell.org 2026-08-16T21:43:07Z
+  , cardano-haskell-packages 2026-08-16T21:33:08Z
+
 
 active-repositories:
   , :rest
@@ -165,3 +166,178 @@ if impl(ghc >= 9.14)
     , vary:aeson
     , with-utf8:base
 -- cabal-allow-newer end
+
+-- =============================================================================
+-- crypton >=1.1 / ram migration (also picks up the crypton-x509-validation fix
+-- for CVE-2026-9648, X.509 NameConstraints not enforced below 1.9.1).
+-- =============================================================================
+
+constraints:
+  , any.crypton >= 1.1 && < 1.2
+  , any.crypton-x509-validation >= 1.9.1
+
+-- cardano-crypto-class-2.6.0.0 is the first release on the crypton>=1.1/ram
+-- line and is already published to CHaP -- but each of these still caps it at
+-- ^>=2.3 (<2.4). Relax them from here rather than editing every .cabal file.
+-- (This list was found empirically: add the constraint, re-run `cabal build
+-- all --enable-tests --dry-run`, and let each conflict name the next package.)
+allow-newer:
+  , cardano-node:cardano-crypto-class
+  , cardano-submit-api:cardano-crypto-class
+  , cardano-node-chairman:cardano-crypto-class
+  , cardano-testnet:cardano-crypto-class
+  , cardano-cli:cardano-crypto-class
+  , cardano-ledger-binary:cardano-crypto-class
+  , cardano-ledger-core:cardano-crypto-class
+  , cardano-ledger-mary:cardano-crypto-class
+  , cardano-ledger-shelley:cardano-crypto-class
+  , cardano-protocol-tpraos:cardano-crypto-class
+  , ouroboros-consensus:cardano-crypto-class
+  , kes-agent:cardano-crypto-class
+  , kes-agent-crypto:cardano-crypto-class
+
+  -- cardano-api PR #1292 bumps aeson's lower bound to >=2.3 (an independent
+  -- DoS-vulnerability fix, see HSEC-2026-0007, bundled in the same branch --
+  -- not itself part of the crypton/ram migration). Several packages transitively
+  -- pulled in (via ouroboros-network -> trace-dispatcher, and plutus-core's
+  -- bench/testlib deps) still hard-cap aeson <2.3 on Hackage, with no newer
+  -- release to relax it from our end. This is the same allow-newer list the
+  -- PR's own cabal.project added for the same reason.
+  , cborg-json:aeson
+  , criterion-measurement:aeson
+  , deriving-aeson:aeson
+  , grapesy:aeson
+  , grpc-spec:aeson
+  , hedgehog-extras:aeson
+  , ekg-json:aeson
+  , microstache:aeson
+  , vary:aeson
+  , monad-control:transformers
+  , http-api-data:text-iso8601
+
+  -- kes-agent-1.2.0.0's DirectCodec.hs fails to compile against
+  -- cardano-crypto-class-2.6.0.0 (Could not deduce 'KnownNat (2 *
+  -- TotalPeriodsKES kes)'). 1.3.0.0 (see the source-repository-package below)
+  -- moves to the FixedSizeCodec API and fixes this; these still cap kes-agent
+  -- and kes-agent-crypto to the 1.2.x/1.1.x line.
+  , cardano-node:kes-agent
+  , ouroboros-consensus:kes-agent
+  , ouroboros-consensus:kes-agent-crypto
+  , dmq-node:kes-agent-crypto
+
+  -- cardano-crypto-wrapper-1.8.0.0 (ram migration, see the source-repository-
+  -- package below); cardano-cli still caps it to ^>=1.7 (<1.8).
+  , cardano-cli:cardano-crypto-wrapper
+
+-- grapesy has no Hackage release with the relaxed tls/crypton-x509* bounds yet;
+-- the fix is on its unreleased main branch. Remove this once a real release
+-- picks it up -- see https://github.com/well-typed/grapesy.
+source-repository-package
+  type: git
+  location: https://github.com/well-typed/grapesy
+  tag: bd6af64f69ff89e3a8fc02e2c81262e648f4715d
+  subdir: grapesy
+
+-- cardano-crypto 1.4.0 (crypton>=1.1/ram) is only on the unreleased develop
+-- branch, no tag/release exists yet. Remove this once a real release picks it
+-- up -- see https://github.com/IntersectMBO/cardano-crypto.
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/cardano-crypto
+  tag: ac2e12a471b735ad80949bcbf0f6f634e5dbef77
+
+-- cardano-crypto-wrapper-1.7.0.0 (in cardano-ledger) still depends directly on
+-- the old memory package and has no upper bound wide enough to build against
+-- cardano-crypto-1.4.0's ram-based API (real compile errors: "No instance for
+-- ByteArrayAccess ..." wherever memory's ScrubbedBytes/Bytes meet cardano-crypto's
+-- ram-based ones). This commit (draft PR, no CPP -- crypton>=1.1 hard requirement,
+-- so this branch only builds against the ram line) switches it to `ram` and
+-- widens the cardano-crypto-class bound. Remove this once
+-- https://github.com/IntersectMBO/cardano-ledger/pull/5999 merges and a
+-- release picks it up.
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/cardano-ledger
+  tag: 6def84b5ae0033053feda72f32b1dac41c812e0e
+  subdir: eras/byron/crypto
+
+-- ouroboros-consensus PR #2213 (erikd/ram) is now based on the
+-- release-ouroboros-consensus-3.0.1.0 tag (it was previously based on main,
+-- which resolved to 4.0.0.0 and dropped the `lmdb` sublibrary that
+-- cardano-node.cabal hard-requires -- see git history for that dead end).
+-- This backports just the crypton>=1.1/ram migration plus the Byron
+-- FixedSizeCodec instances cardano-crypto-class-2.6.0.0's DSIGNAlgorithm
+-- superclass needs, onto 3.0.1.0, so the version stays 3.0.1.0 and no
+-- allow-newer is needed for ouroboros-consensus's own version bound. Remove
+-- once https://github.com/IntersectMBO/ouroboros-consensus/pull/2213 merges
+-- and a release picks it up.
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/ouroboros-consensus
+  tag: 4da82e0afed5dabbe930d5f5cad5de687428e07b
+
+-- cardano-crypto-class-2.6.0.0's testlib bumped contra-tracer to ^>=0.2.1
+-- (incidentally, in an unrelated 2.5.0.0 change), which network-mux-0.10.1.0's
+-- Trace.hs cannot actually compile against. Rather than the allow-older
+-- workaround this replaces, use the real fix: cardano-base PR #694
+-- (erikd/contra-tracer) widens testlib's bound to contra-tracer >=0.1 && <0.3
+-- via CPP, supporting both lines properly. Remove this once the PR merges and
+-- a release picks it up -- see https://github.com/IntersectMBO/cardano-base/pull/694.
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/cardano-base
+  tag: ad3afec8113872652ec8edf19ae1280552ce2a20
+  subdir: cardano-crypto-class
+
+-- kes-agent-1.3.0.0 moves to the FixedSizeCodec API (fixing the
+-- KnownNat/deprecation issues against cardano-crypto-class-2.6.0.0) and, like
+-- cardano-base PR #694, uses CPP to widen its own contra-tracer bound to
+-- >=0.1 && <0.3. No tagged release exists yet. Remove this once
+-- https://github.com/input-output-hk/kes-agent/pull/105 merges and a release
+-- picks it up.
+source-repository-package
+  type: git
+  location: https://github.com/input-output-hk/kes-agent
+  tag: 8cfcc91b40e9bc37f3e2bb5bf389029f6a0ca230
+  subdir:
+    kes-agent
+    kes-agent-crypto
+
+-- cardano-api PR #1292 (erikd/crypton+ram): properly widens cardano-api's own
+-- cardano-crypto-class (^>=2.6), cardano-binary (>=1.9.1), cardano-crypto-wrapper
+-- (^>=1.7 || ^>=1.8), and validation (^>=1.2) bounds (so the allow-newer
+-- entries above are no longer needed for cardano-api), migrates its DSIGN
+-- operations to the FixedSizeCodec API, adapts to cardano-crypto-class-2.5's
+-- BLS12381SignContext/testlib changes, fixes the validation package's 1.1->1.2
+-- breaking rewrite, and bridges cardano-addresses' vendored XPrv type to
+-- cardano-crypto's (they stopped unifying once cardano-crypto-1.4.0 and
+-- cardano-addresses-4.0.7+ were patched for crypton>=1.1/ram independently).
+-- Version stays 11.3.0.0. No tagged release exists yet. Remove this once the
+-- PR merges and a release picks it up.
+source-repository-package
+  type: git
+  location: https://github.com/input-output-hk/cardano-api
+  tag: c6b1d3ddb68396f0e16f46c3e86e985fbc2b3fdb
+  subdir: cardano-api
+
+-- TEMPORARY: cardano-cli master HAS now landed its own fix for the crypton/ram
+-- + validation-1.2 migration (commits c3d4bb02f/1f858d0d3/1d8900994), but it
+-- did so in lockstep with moving cardano-cli onto the newer, unrelated
+-- cardano-api-11.4.x / cardano-diffusion-1.1.1.x release train -- master's
+-- cabal file now requires cardano-api ^>=11.4 and cardano-diffusion (lib
+-- ping) ^>=1.1.1, neither of which our pinned cardano-api-11.3.0.0 (PR #1292)
+-- / ouroboros-network-1.1.0.0 (kept off ouroboros-consensus ^>=4.1 to avoid
+-- the lmdb->lsm migration) can satisfy -- allow-newer/allow-older can't paper
+-- over a lower-bound-plus-new-component conflict like this one, it needs the
+-- whole diffusion stack bumped. So instead this points at
+-- https://github.com/IntersectMBO/cardano-cli/pull/1417 (erikd/crypton-ram),
+-- a compat branch built from the pre-bump cardano-cli-11.1.0.0 release tag
+-- (796f79f01), carrying just the crypton/ram + validation-1.2 port and none
+-- of the cardano-api-11.4 bump. Remove entirely once cardano-cli backports
+-- this onto a cardano-api-11.3.x-compatible base upstream, or once
+-- cardano-node moves to the ouroboros-consensus 4.x line.
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/cardano-cli
+  tag: 5b3feaaa0a24ffa33e961ab06b84d9d6f645bbb7
+  subdir: cardano-cli

cardano-node-chairman/app/Cardano/Chairman.hs

@@ -15,8 +15,6 @@ import           Cardano.Api
 
 import           Cardano.Ledger.BaseTypes (unNonZero)
 import           Ouroboros.Consensus.Block.Abstract
-import           Ouroboros.Consensus.Cardano.Block
-import           Ouroboros.Consensus.Config.SecurityParam
 import           Ouroboros.Network.AnchoredFragment (Anchor, AnchoredFragment)
 import qualified Ouroboros.Network.AnchoredFragment as AF
 import qualified Ouroboros.Network.Block as Block

cardano-node-chairman/app/Cardano/Chairman/Commands/Run.hs

@@ -19,7 +19,6 @@ import           Cardano.Node.Protocol
 import           Cardano.Node.Types
 import           Cardano.Prelude (ConvertText (..))
 import qualified Ouroboros.Consensus.Config as Consensus
-import           Ouroboros.Consensus.Config.SecurityParam (SecurityParam (..))
 import           Ouroboros.Consensus.Config.SupportsNode
 import           Ouroboros.Consensus.Node.ProtocolInfo
 

cardano-node-chairman/cardano-node-chairman.cabal

@@ -51,7 +51,7 @@ executable cardano-node-chairman
                       , contra-tracer
                       , io-classes:{io-classes, strict-stm, si-timers} ^>= 1.8
                       , optparse-applicative
-                      , ouroboros-consensus:{ouroboros-consensus, cardano}
+                      , ouroboros-consensus:ouroboros-consensus
                       , ouroboros-network:{api, protocols}
                       , text
                       , time

cardano-node/src/Cardano/Node/Protocol/Checkpoints.hs

@@ -11,10 +11,8 @@ module Cardano.Node.Protocol.Checkpoints
 import           Cardano.Api
 
 import qualified Cardano.Crypto.Hash.Class as Crypto
-import           Cardano.Protocol.Crypto (StandardCrypto)
 import           Cardano.Node.Types
 import           Ouroboros.Consensus.Block
-import           Ouroboros.Consensus.Cardano
 import           Ouroboros.Consensus.Config (CheckpointsMap (..), emptyCheckpointsMap)
 
 import           Control.Exception (IOException)

cardano-node/src/Cardano/Node/Protocol/Shelley.hs

@@ -39,7 +39,6 @@ import           Cardano.Node.Tracing.Era.Shelley ()
 import           Cardano.Node.Tracing.Formatting ()
 import           Cardano.Node.Tracing.Tracers.ChainDB ()
 import           Cardano.Node.Types
-import           Cardano.Protocol.Crypto (StandardCrypto)
 import qualified Ouroboros.Consensus.Cardano as Consensus
 import           Ouroboros.Consensus.HardFork.Combinator.AcrossEras ()
 import           Ouroboros.Consensus.Protocol.Praos.Common (PraosCanBeLeader (..),

cardano-node/src/Cardano/Node/Tracing/Era/Shelley.hs

@@ -408,15 +408,15 @@ instance
              , "acceptable" .= Set.toList acceptable
              ]
   forMachine _ (ExtraRedeemers rdmrs) =
-    Api.caseShelleyToMaryOrAlonzoEraOnwards
-      (const mempty)
+    Api.forEraInEon
+      (Api.convert (Api.shelleyBasedEra :: Api.ShelleyBasedEra era))
+      mempty
       (\alonzoOnwards ->
          mconcat
            [ "kind" .= String "ExtraRedeemers"
            , "rdmrs" .=  map (Api.toScriptIndex alonzoOnwards) (NonEmpty.toList rdmrs)
            ]
       )
-      (Api.shelleyBasedEra :: Api.ShelleyBasedEra era)
   forMachine _ (ScriptIntegrityHashMismatch Mismatch {mismatchSupplied, mismatchExpected} mBytes) =
       mconcat [ "kind" .= String "ScriptIntegrityHashMismatch"
               , "supplied" .= renderScriptIntegrityHash (strictMaybeToMaybe mismatchSupplied)
@@ -1547,15 +1547,15 @@ instance
               , "txins" .= NonEmptySet.toList ins
               ]
     Conway.ExtraRedeemers rs ->
-      Api.caseShelleyToMaryOrAlonzoEraOnwards
-        (const mempty)
+      Api.forEraInEon
+        (Api.convert (Api.shelleyBasedEra :: Api.ShelleyBasedEra era))
+        mempty
         (\alonzoOnwards ->
            mconcat
              [ "kind" .= String "ExtraRedeemers"
              , "rdmrs" .=  map (Api.toScriptIndex alonzoOnwards) (NonEmpty.toList rs)
              ]
         )
-        (Api.shelleyBasedEra :: Api.ShelleyBasedEra era)
     Conway.MalformedScriptWitnesses scripts ->
       mconcat [ "kind" .= String "MalformedScriptWitnesses"
               , "scripts" .= scripts

cardano-node/src/Cardano/Node/Tracing/Render.hs

@@ -218,9 +218,10 @@ renderScriptPurpose :: ()
   => Api.ShelleyBasedEra era
   -> PlutusPurpose AsItem (Api.ShelleyLedgerEra era)
   -> Aeson.Value
-renderScriptPurpose =
-  Api.caseShelleyToMaryOrAlonzoEraOnwards
-    (const (const Aeson.Null))
+renderScriptPurpose sbe =
+  Api.forEraInEon
+    (Api.convert sbe)
+    (const Aeson.Null)
     (\case
       Api.AlonzoEraOnwardsAlonzo -> renderAlonzoPlutusPurpose
       Api.AlonzoEraOnwardsBabbage -> renderAlonzoPlutusPurpose

cardano-testnet/src/Testnet/Runtime.hs

@@ -507,9 +507,9 @@ startLedgerNewEpochStateLogging testnetRuntime tmpWorkspace = withFrozenCallStac
             -> SlotNo
             -> BlockNo
             -> StateT (Maybe AnyNewEpochState) IO ConditionResult
-    handler outputFp diffFp anes@(AnyNewEpochState !sbe !nes _) _ (BlockNo blockNo) = handleException $ do
+    handler outputFp diffFp anes@(AnyNewEpochState !sbe !nes _) _ (BlockNo blockNumber) = handleException $ do
       let prettyNes = shelleyBasedEraConstraints sbe (encodePretty nes)
-          blockLabel = "#### BLOCK " <> show blockNo <> " ####"
+          blockLabel = "#### BLOCK " <> show blockNumber <> " ####"
       liftIOAnnotated . BSC.appendFile outputFp $ BSC.unlines [BSC.pack blockLabel, prettyNes, ""]
 
       -- store epoch state for logging of differences

cardano-testnet/src/Testnet/Start/Cardano.hs

@@ -461,9 +461,9 @@ cardanoTestnet
           QuickValidation
           (EpochNo maxBound)
           minBound
-          $ \_ slotNo blockNo -> do
+          $ \_ slotNo blockNumber -> do
             put slotNo
-            pure $ if blockNo >= 1
+            pure $ if blockNumber >= 1
                then ConditionMet -- we got one block
                else ConditionNotMet
 

cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/FoldEpochState.hs

@@ -43,8 +43,8 @@ prop_foldEpochState = integrationRetryWorkspace 2 "foldEpochState" $ \tempAbsBas
         -> SlotNo
         -> BlockNo
         -> StateT [(SlotNo, BlockNo)] IO ConditionResult
-      handler _ slotNo blockNo = do
-        modify ((slotNo, blockNo):)
+      handler _ slotNo blockNumber = do
+        modify ((slotNo, blockNumber):)
         s <- get
         if length s >= 10
           then pure ConditionMet

cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Rpc/Query.hs

@@ -82,9 +82,9 @@ hprop_rpc_query_pparams = integrationRetryWorkspace 2 "rpc-query-pparams" $ \tem
   ----------
   QueryTipLocalStateOutput{localStateChainTip} <-
     H.noteShowM $ execCliStdoutToJson execConfig [eraName, "query", "tip"]
-  (slot, blockHash, blockNo) <- case localStateChainTip of
+  (slot, blockHash', blockNumber) <- case localStateChainTip of
     ChainTipAtGenesis -> H.failure -- impossible
-    ChainTip (SlotNo slot) (HeaderHash hash) (BlockNo blockNo) -> pure (slot, SBS.fromShort hash, blockNo)
+    ChainTip (SlotNo slot) (HeaderHash hash) (BlockNo blockNumber) -> pure (slot, SBS.fromShort hash, blockNumber)
 
   -----------------------------------
   -- Compute expected tip timestamp
@@ -121,8 +121,8 @@ hprop_rpc_query_pparams = integrationRetryWorkspace 2 "rpc-query-pparams" $ \tem
   -- Test readParams response
   ---------------------------
   pparamsResponse ^. U5c.ledgerTip . U5c.slot === slot
-  pparamsResponse ^. U5c.ledgerTip . U5c.hash === blockHash
-  pparamsResponse ^. U5c.ledgerTip . U5c.height === blockNo
+  pparamsResponse ^. U5c.ledgerTip . U5c.hash === blockHash'
+  pparamsResponse ^. U5c.ledgerTip . U5c.height === blockNumber
   H.assertWithinTolerance (pparamsResponse ^. U5c.ledgerTip . U5c.timestamp) expectedTimestampMs 1000
 
   -- https://docs.cardano.org/about-cardano/explore-more/parameter-guide